ISO 42001 is a voluntary international standard for AI management systems — any organisation anywhere can adopt it. The EU AI Act is binding law with fines up to 7% of global revenue for non-compliance, applying to organisations that develop or deploy AI systems in the EU. They overlap in scope but differ fundamentally: one is a best-practice framework, the other is a regulatory obligation. On the AIGP exam, both are tested — but tested differently.
ISO/IEC 42001 and the EU AI Act are frequently mentioned together in AI governance discussions, which leads to a common misconception: that ISO 42001 certification is a pathway to EU AI Act compliance. It is not — though it is genuinely useful as a governance framework that organisations implementing the EU AI Act can draw from. Understanding the precise relationship matters both for AIGP exam scenarios and for practitioners advising on real compliance programmes.
Side-by-Side: The Core Differences
| Dimension | ISO/IEC 42001 | EU AI Act |
|---|---|---|
| Nature | Voluntary international standard (ISO/IEC) | Binding law (EU Regulation 2024/1689) |
| Jurisdiction | Global — any organisation in any country | EU scope — applies to providers and deployers with EU market access |
| Obligation | No legal obligation; organisations opt in | Legal obligation; non-compliance triggers fines |
| Enforcement | None — third-party audit for certification is optional | National market surveillance authorities + European AI Office |
| Penalties | No financial penalties for non-adoption | Up to 7% of global annual revenue (prohibited AI); 3% (other violations) |
| Who it covers | Any organisation developing or deploying AI | Providers and deployers of AI systems placed on the EU market |
| Focus | Management system for responsible AI development — policies, processes, controls | Risk-tier obligations by AI system type: prohibited, high-risk, limited risk, minimal risk |
| Certification | Third-party certification available (via accredited bodies) | Conformity assessment (self-assessment or notified body) for high-risk systems |
| AIGP exam relevance | Tested in Domain II alongside ISO 42005 — framework knowledge, not memorisation | Tested extensively across Domains II, III, and IV — risk tiers, roles, obligations, deadlines |
Where They Overlap
The conceptual overlap between ISO 42001 and the EU AI Act is genuine and significant. Both frameworks:
Shared Concepts
- Risk assessment and risk management across the AI system lifecycle
- Accountability structures and defined roles (provider, deployer, affected persons)
- Documentation requirements and audit readiness
- Human oversight mechanisms
- Transparency obligations toward affected parties
- Incident response and post-deployment monitoring
Key Divergence Points
- EU AI Act creates legal obligations; ISO 42001 creates best-practice targets
- EU AI Act specifies risk tiers and ties different obligation levels to each; ISO 42001 is a uniform framework across all AI systems
- EU AI Act has specific prohibited-use categories; ISO 42001 does not prohibit anything
- Conformity assessment under the EU AI Act is a legal requirement for high-risk systems; ISO 42001 certification is voluntary
Does ISO 42001 Certification Help with EU AI Act Compliance?
Partially, and in a specific way. ISO 42001 provides a structured management system framework that maps to several of the operational requirements the EU AI Act imposes on high-risk AI system providers — risk management, quality management, transparency, human oversight. An organisation that has already implemented ISO 42001 will have documentation practices, risk assessment processes, and governance structures that can be adapted to meet EU AI Act conformity assessment requirements.
However, ISO 42001 certification does not constitute EU AI Act compliance. The EU AI Act imposes specific obligations — mandatory conformity assessments for high-risk systems, registration in the EU database, Fundamental Rights Impact Assessments for certain deployers — that ISO 42001 does not cover or substitute for. The relationship is supplementary, not substitutive.
The February 2026 BoK v2.1 update formally added ISO 42005 alongside ISO 42001 to the Domain II testing scope. Exam questions on these standards test framework knowledge and appropriate application in governance scenarios — not article-level memorisation. The key distinction to know for scenarios: ISO 42001 covers the management system; ISO 42005 covers AI impact assessment methodology. Both are different from the EU AI Act’s conformity assessment requirements. See BoK v2.1 changes for the full update breakdown.
Which Should Your Organisation Prioritise?
| Situation | Prioritise | Why |
|---|---|---|
| EU market access with high-risk AI systems | EU AI Act compliance first | Legal obligation with financial penalties. ISO 42001 can support implementation but doesn’t substitute for mandatory conformity assessment. |
| Global operations, no specific EU regulatory exposure | ISO 42001 first | Voluntary framework that provides governance structure without jurisdiction-specific legal obligations. Strong signal for enterprise procurement and investor ESG reporting. |
| Preparing for EU market entry | Both in parallel | ISO 42001 builds the management infrastructure; EU AI Act compliance maps specific regulatory obligations onto it. Implementing them together is more efficient than sequentially. |
| Financial services with AI audit requirements | EU AI Act + ISO 42001 + ISACA AAIA | Financial services AI oversight increasingly references all three frameworks. SR 26-2 guidance for US institutions also aligns with ISO 42001 risk management principles. |
Is ISO 42001 the same as EU AI Act compliance?
No. ISO 42001 is a voluntary management system standard. The EU AI Act is binding law. ISO 42001 certification does not constitute EU AI Act compliance, though it provides a useful governance framework that organisations can adapt when implementing EU AI Act requirements.
Does the AIGP exam test ISO 42001?
Yes. BoK v2.1 (effective February 2026) explicitly includes ISO 42001 and ISO 42005 in Domain II testing. Questions test framework knowledge and appropriate application in governance scenarios, not article-level memorisation.
What is ISO 42005?
ISO 42005 covers AI system impact assessment methodology — how to assess the impacts of an AI system on individuals, groups, and society. It is distinct from ISO 42001 (the management system standard) and was added to AIGP BoK v2.1 in February 2026.
Who needs ISO 42001 certification?
No one legally — it’s voluntary. Organisations pursue it as a governance maturity signal for customers, investors, and regulators. It is increasingly referenced in enterprise AI procurement requirements and ESG reporting frameworks. See ISO 42001 explained for the full breakdown.
ISO 42001 and the EU AI Act address overlapping territory but are fundamentally different instruments: one is voluntary best practice, the other is binding law. For organisations with EU market exposure and high-risk AI systems, the EU AI Act is the compliance priority — ISO 42001 can support implementation but does not substitute for it. For the AIGP exam, both are tested in Domain II, but the EU AI Act is tested far more extensively across all four domains. Know the difference before exam day.
Related reading: ISO 42001 explained, EU AI Act risk classifications with examples, and AIGP BoK v2.1 changes.